agent-embassy 1.7.0 → 1.8.0

package/skills/embassy-peer/SKILL.md

@@ -31,7 +31,7 @@ embassy health
 
 If Embassy is unavailable, stop and report that it must be started in a trusted local terminal with `embassy serve`. `GATEWAY_INSTANCE_IN_USE` means an Embassy or recognized legacy lock already owns this login account; stop that foreground process rather than changing `EMBASSY_STATE_DIR`. If no legacy process remains, the operator may remove only the exact stale legacy controller lock and retry. Do not launch a background copy, retry in a loop, discover sockets, or fall back to a provider CLI.
 
-Embassy presents Claude, Codex, DeepSeek, and Grok as first-class providers. Runtime status is best-effort: use route staleness, connector health, observed metadata, and the last safe code to explain what is available now. Provider versions are diagnostic metadata, not routing authority; the release-owned offline support matrix is the record of tested artifacts, capabilities, limitations, and test dates. There is no agent or operator compatibility action. Report a degraded surface and stop rather than sending a test message or trying to override a failed route.
+Embassy presents Claude, Codex, DeepSeek, and Grok as first-class providers. Runtime status is best-effort: use observation freshness, connector health, observed metadata, and the last safe code to explain what is available now. Provider versions are diagnostic metadata, not routing authority; the release-owned offline support matrix is the record of tested artifacts, capabilities, limitations, and test dates. There is no agent or operator compatibility action. Report a degraded surface and stop rather than sending a test message or trying to override a failed operation.
 
 List the public snapshot:
 
@@ -93,27 +93,25 @@ Register only from the Codex task being named:
 embassy register-codex --alias codex-reviewer@this-mac
 ```
 
-Let the CLI read that task's inherited `CODEX_THREAD_ID`. Never supply the thread ID as an argument, print it, persist it, or register another task by guessing its identity. The alias must start with `codex-`; a successful registration advertises that task for native inbound turns.
+Let the CLI read that task's inherited `CODEX_THREAD_ID`. Never supply the thread ID as an argument, print it, persist it, or register another task by guessing its identity. The alias must start with `codex-`. Registration commits only the logical route record and performs no provider or App Server I/O. Advertisement reconciles separately and best-effort; bounded observation is display-only and never routing authority or a dispatch gate. Every Codex operation independently attests the current interface and resumes the exact registered task before final write authorization.
 
 The first successful Codex registration fixes its exact alias, task, and host
-until it is explicitly succeeded. Exact re-registration remains available for
-connector recovery. To hand the registration to a different task on the same
-host, run this from inside the successor task:
+until it is removed or explicitly succeeded. To hand the registration to a
+different task on the same host, run this from inside the successor task:
 
 ```sh
 embassy register-codex --alias codex-successor@this-mac --succeeds codex-reviewer@this-mac
 ```
 
-This is the only supported identity change without restarting the broker.
-Embassy freezes the outgoing route, drains its accepted work to terminal
-settlement, and publishes the successor on a fresh listener generation.
-Nothing transfers: no queued body, conversation, reply capability, or delivery
-token. A succession that cannot be completed pins the identity fail-closed
-until manual recovery rather than leaving two live registrations.
-
-Embassy also pins the exact identity fail-closed when a retained route cannot fully reactivate or a fresh registration cannot confirm complete rollback. Retry only that exact identity; choose another only after the old route is confirmed unregistered and Embassy is restarted.
-
-A Codex App Server generation change or broker restart can reattach an exact registered task automatically. Each replacement generation negotiates its current interface and must observe the exact task before the controller re-anchors it. A normal broker restart therefore needs no manual registration. If boot reactivation cannot find the task exactly once, the route remains stale with `REOBSERVATION_REQUIRED`; once the task is observable, recover it only from that exact Codex task by rerunning `embassy register-codex --alias <same-alias>`. Do not unregister first, supply a thread ID, or replay any ambiguously written body.
+This is one atomic logical replacement. The commit cancels queued or reserved
+work with `ROUTE_UNREGISTERED`, settles armed work `ambiguous` and accepted
+work `unconfirmed`, removes every incident consent edge and capability, and
+installs only the successor. It never waits for a model turn and has no
+prepared listener, activation, re-anchoring, succession journal, or recovery
+generation. Nothing transfers: no conversation, reply or native capability,
+pairing authority, rate ownership, or deduplication ownership. Advertisement
+of the successor reconciles asynchronously and cannot roll back the committed
+logical identity.
 
 Unregister from the same Codex task:
 
@@ -122,6 +120,10 @@ embassy unregister-codex --alias codex-reviewer@this-mac
 ```
 
 If the task identity or selector does not match, stop on the fail-closed result.
+Successful unregister is the exact-owner form of the same atomic removal: it
+removes incident consent edges and conversation, reply, or native capabilities,
+cancels queued/reserved work, settles armed work `ambiguous`, and settles
+accepted work `unconfirmed`.
 
 ## Send a message
 
@@ -146,7 +148,7 @@ The foreground launcher supports native bidirectional messaging for each explici
 
 Direction determines timing. Once routing and pre-write checks pass, every Claude-bound send or correlated reply writes immediately to Claude's native mailbox regardless of its observed busy or idle state. Do not wait for Claude to become idle or report its busy state as a queue reason. `transport_written` is the terminal `delivered` boundary for that direction and means mailbox write, not read or consumption. Codex-bound ordinary work remains idle/turn-boundary gated; only the exact `STEER:` behavior below may target the active turn's next tool-call boundary.
 
-An accepted send returns a public conversation token and a fresh delivery token. The delivery token is an opaque, memory-only correlation handle, exactly `dlv_` plus 24 base64url characters. Use the exact returned values only for their intended CLI calls; do not construct, shorten, log, persist, or place either token in an agent-created file.
+An accepted send returns a public conversation token and a fresh delivery token. The conversation token and reply capability are memory-only. The delivery token is an opaque correlation handle, exactly `dlv_` plus 24 base64url characters, retained only with its bounded private v3 message row. Use the exact returned values only for their intended CLI calls; do not construct, shorten, log, persist yourself, or place either token in an agent-created file.
 
 Use exactly one send for one user-authorized message. A send never selects a Claude session automatically. Do not automatically retry, fan out, hand-roll a poll loop, or fall back to Claude Code's native `SendMessage`.
 
@@ -192,15 +194,15 @@ embassy wait-delivery --token dlv_0123456789abcdefghijklmn
 
 It checks every 250 ms and emits only a terminal result. It stops at the delivery deadline plus 3 seconds; an unknown token fails immediately. Exit `0` means `delivered`; every other terminal state (`unconfirmed`, `expired`, `failed`, `ambiguous`, or `cancelled`) preserves its exact JSON result and uses the shared delivery-failure exit `6`. An unknown token exits `3`. A local waiter timeout exits `4`, is not a terminal result, and is not permission to resend. A terminal result closes only that delivery attempt: `delivered` does not promise a reply, and `unconfirmed` or `ambiguous` must never be retried automatically.
 
-The in-memory status table is bounded. Under pressure, only its oldest terminal handle may be evicted; active `queued` or `stalled` handles are retained. An evicted handle returns `{"found":false}`.
+The private v3 message ledger is bounded. Under pressure, its oldest terminal row may be evicted while active `queued` or `stalled` rows are retained. A token absent from bounded retention returns `{"found":false}`.
 
 ## Interpret queue state
 
 Treat `accepted` as gateway ownership, not proof that the peer read or answered the message. Use `delivery-status` for the accepted delivery, or `status` and the dashboard for aggregate route state, when the user asks for progress. The optional `pendingForMs` field is age since acceptance, including in-flight time. `stalled` remains nonterminal. A Claude-bound tracker may be briefly `queued` for routing or pre-write work, but a busy Claude observation never idle-gates it: after those checks, the native mailbox write is immediate and `transport_written` settles `delivered`.
 
-For native Claude-to-Codex ingress, Embassy first attempts immediate dispatch. A terminal result observed before the one-second prompt boundary produces only its terminal acknowledgement; native `held` is sent only when the body truly remains queued or dispatch is still nonterminal at that boundary, followed later by the terminal acknowledgement. Claude's rendered “approved and released” notice means only that the paired-consent gateway accepted and released the body to the recipient queue — released is not read, and no human approval is implied. The default `merged` notice policy separately sends at most one nonterminal stall user frame exactly at `floor(messageDeadlineMs / 2)`, containing only a bounded pending age and allowlisted reason. The operator may choose `verbose` to retain the additional terminal diagnostic user frame or `quiet` to suppress gateway-authored user-frame notices; native status and dashboard truth do not change. Codex-bound ordinary work queues while the Codex task is active or temporarily unavailable. Only when the user explicitly asks to steer the active Codex turn may a Claude sender put the exact prefix `STEER:` at the beginning of the body. Embassy submits that input at the next tool-call boundary, never mid-generation or by interrupting; clean boundary refusal silently returns it to the normal queue. At most three steering messages remain queued per route, and the dashboard journal labels their lifecycle with `STEER`. If a registered Codex connector is closed or faulted, an explicit `register-codex` replaces it and wakes held work when the recovered route is idle; it never retries an ambiguous write.
+For native Claude-to-Codex ingress, Embassy first attempts immediate dispatch. A terminal result observed before the one-second prompt boundary produces only its terminal acknowledgement; native `held` is sent only when the body truly remains queued or dispatch is still nonterminal at that boundary, followed later by the terminal acknowledgement. Claude's rendered “approved and released” notice means only that the paired-consent gateway accepted and released the body to the recipient queue — released is not read, and no human approval is implied. The default `merged` notice policy separately sends at most one nonterminal stall user frame exactly at `floor(messageDeadlineMs / 2)`, containing only a bounded pending age and allowlisted reason. The operator may choose `verbose` to retain the additional terminal diagnostic user frame or `quiet` to suppress gateway-authored user-frame notices; native status and dashboard truth do not change. Codex-bound ordinary work queues while the Codex task is active or temporarily unavailable. Only when the user explicitly asks to steer the active Codex turn may a Claude sender put the exact prefix `STEER:` at the beginning of the body. Embassy uses the exact accepted operation's same-session capability at the next tool-call boundary, never mid-generation or by interruption. Clean boundary refusal returns it to the normal queue; the cap is three steers per exact active operation. Embassy never calls `turn/interrupt` and never retries an ambiguous write.
 
-Do not synthesize `STEER:`, use it from Codex to Claude, approve permissions, widen tools, alter inbound-message policy, or interrupt a turn to force delivery. Report `held`, refused, incompatible, full, expired, unavailable, or `STEER_QUEUE_SUPERSEDED` outcomes or safe error codes without treating them as additional `delivery-status` states and without retrying. Native receipt settlement follows the originating Claude session's stable UUID and revalidates its current endpoint before every stall or terminal write; names, PIDs, and sockets are not receipt identity. Ordinary process/socket rotation for the same Claude UUID is therefore refreshed automatically. After a gateway restart, the prior UUID-bound selection starts stale, but the next authorized complete discovery may reactivate exactly that UUID and adopt its latest name. A changed UUID, name or UUID collision, incomplete discovery, or failed workspace/provider revalidation stays stale; do not retry around it. Queued or in-flight text, callbacks, native receipt handles, delivery tokens/status trackers, pending replies, and conversation capabilities do not survive. A pre-restart delivery token is unknown and no body is replayed.
+Do not synthesize `STEER:`, use it from Codex to Claude, approve permissions, widen tools, alter inbound-message policy, or interrupt a turn to force delivery. Report `held`, refused, incompatible, full, expired, unavailable, or `STEER_QUEUE_SUPERSEDED` outcomes or safe error codes without treating them as additional `delivery-status` states and without retrying. Native receipt settlement follows the originating Claude session's stable UUID and revalidates its current endpoint before every stall or terminal write; names, PIDs, and sockets are not receipt identity. Ordinary process/socket rotation for the same Claude UUID is refreshed for that write. After a gateway restart, queued or reserved messages and their delivery tokens/status remain inspectable in the bounded private v3 ledger and may resume once within their deadline and attempt budget against the same exact route and consent edge. Armed work settles `ambiguous`; accepted work settles `unconfirmed`; neither is replayed. Conversations, reply/native capabilities, raw provider frames, callbacks, pending replies, and socket paths remain memory-only. Best-effort observation may refresh what status displays, but it never authorizes or gates delivery.
 
 ## Preserve the boundary
 
@@ -219,9 +221,13 @@ per-invocation `--port <n>`. It deliberately has no login, token, cookie, browse
 session, or local-process/UID authentication and assumes a trusted single-user
 machine; local software that can reach or spoof loopback can use it. Its only
 mutations are explicitly confirmed two-endpoint pair, unpair,
-refresh-discovery, and broker-guarded stale-registration-removal actions. It
-has no registration creation, live unregistration, send, reply, approval,
+refresh-discovery, and named Codex-registration-removal actions. Confirmed
+`remove_codex_registration` may remove any named Codex registration; its atomic
+commit removes incident consent edges and conversation, reply, or native
+capabilities, and settles queued/reserved work `cancelled`, armed work
+`ambiguous`, and accepted work `unconfirmed`. It has no registration creation,
+send, reply, approval,
 interruption, settings, or generic provider authority. Agent-facing paths
 remain `embassy status` for a sanitized snapshot and the static
 `gateway-dashboard.html` for offline metadata. A status snapshot observation
-may settle already-due lifecycle deliveries before projecting state.
+may settle already-due delivery deadlines before projecting state.

package/dist/src/gateway/codex-registration-generation.d.ts

@@ -1,5 +0,0 @@
-/** Closed grammar for opaque Codex listener and succession generations. */
-export declare function isCodexRegistrationGeneration(value: unknown): value is string;
-export declare function assertCodexRegistrationGeneration(value: unknown, label?: string): asserts value is string;
-/** A fresh 128-bit token that is safe in the closed generation grammar. */
-export declare function createCodexRegistrationGeneration(): string;

package/dist/src/gateway/codex-registration-generation.js

@@ -1,19 +0,0 @@
-import { randomBytes } from "node:crypto";
-const CODEX_REGISTRATION_GENERATION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,31}$/u;
-/** Closed grammar for opaque Codex listener and succession generations. */
-export function isCodexRegistrationGeneration(value) {
-    return (typeof value === "string" &&
-        CODEX_REGISTRATION_GENERATION_PATTERN.test(value));
-}
-export function assertCodexRegistrationGeneration(value, label = "Codex registration generation") {
-    if (!isCodexRegistrationGeneration(value)) {
-        throw new TypeError(`${label} must match the bounded opaque generation grammar.`);
-    }
-}
-/** A fresh 128-bit token that is safe in the closed generation grammar. */
-export function createCodexRegistrationGeneration() {
-    const generation = `g_${randomBytes(16).toString("base64url")}`;
-    assertCodexRegistrationGeneration(generation);
-    return generation;
-}
-//# sourceMappingURL=codex-registration-generation.js.map

package/dist/src/gateway/codex-registration-generation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"codex-registration-generation.js","sourceRoot":"","sources":["../../../src/gateway/codex-registration-generation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,qCAAqC,GACzC,mCAAmC,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAc,EACd,KAAK,GAAG,+BAA+B;IAEvC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,GAAG,KAAK,oDAAoD,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iCAAiC;IAC/C,MAAM,UAAU,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAChE,iCAAiC,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/gateway/codex-registration-succession.d.ts

@@ -1,209 +0,0 @@
-/**
- * Pure lifecycle for replacing one registered Codex task with another.
- *
- * The reducer owns no sockets, registry files, message bodies, conversations,
- * timers, or provider clients. A controller executes the returned effects and
- * feeds the resulting observations back as events. Listener generations are
- * deliberately opaque; this module never derives a socket path or assumes a
- * suffixed-socket naming scheme.
- *
- * Publication arming is the conservative irreversible boundary: the reducer
- * enters it before emitting any durable-journal or registry-write effect.
- * Cleanup may restore the old registration only before arming, or after a
- * controller positively proves that neither the arm nor registry write was
- * persisted. At or after any armed/published/unknown observation, the old
- * registration can never be restored by this machine.
- */
-export declare const codexRegistrationSuccessionPhases: readonly ["active_old", "freezing", "prepared_new", "published_new", "active_new", "offline_poisoned", "recovery_required", "resuming_old"];
-export type CodexRegistrationSuccessionPhase = (typeof codexRegistrationSuccessionPhases)[number];
-export type CodexRegistrationIdentity = Readonly<{
-    alias: string;
-    threadId: string;
-    hostId: string;
-    generation: string;
-}>;
-type StablePhase = "active_old" | "active_new";
-type FreezingStage = "barrier_pending" | "listener_pending" | "store_pending";
-type PublicationBoundary = "not_armed" | "armed_or_unknown" | "published";
-export declare const codexSuccessionFailurePhases: readonly ["freeze", "barrier", "listener", "store", "publication_arm", "registry", "activation", "retirement", "cleanup", "resume"];
-export type CodexSuccessionFailurePhase = (typeof codexSuccessionFailurePhases)[number];
-type SuccessionContext = Readonly<{
-    oldRegistration: CodexRegistrationIdentity;
-    newRegistration: CodexRegistrationIdentity;
-    priorStablePhase: StablePhase;
-}>;
-export type ActiveOldSuccessionState = Readonly<{
-    phase: "active_old";
-    active: CodexRegistrationIdentity;
-}>;
-export type ActiveNewSuccessionState = Readonly<{
-    phase: "active_new";
-    active: CodexRegistrationIdentity;
-    /** At most one prior listener generation may await confirmed retirement. */
-    retired: CodexRegistrationIdentity | null;
-}>;
-export type FreezingSuccessionState = SuccessionContext & Readonly<{
-    phase: "freezing";
-    stage: FreezingStage;
-}>;
-export type PreparedNewSuccessionState = SuccessionContext & Readonly<{
-    phase: "prepared_new";
-    /**
-     * `publication_arming` begins the rollback-forbidden window before the
-     * durable journal effect is executed. `registry_publishing` means the arm
-     * was confirmed and the registry write may be in flight.
-     */
-    stage: "publication_arming" | "registry_publishing";
-}>;
-export type PublishedNewSuccessionState = SuccessionContext & Readonly<{
-    phase: "published_new";
-}>;
-export type OfflinePoisonedSuccessionState = SuccessionContext & Readonly<{
-    phase: "offline_poisoned";
-    failedPhase: CodexSuccessionFailurePhase | "abort" | "barrier_busy";
-    safeErrorCode: string;
-    rollback: "old_allowed" | "forbidden";
-    publicationBoundary: PublicationBoundary;
-}>;
-export type RecoveryRequiredSuccessionState = SuccessionContext & Readonly<{
-    phase: "recovery_required";
-    failedPhase: CodexSuccessionFailurePhase | "abort" | "barrier_busy";
-    safeErrorCode: string;
-    rollback: "old_allowed" | "forbidden";
-    publicationBoundary: PublicationBoundary;
-}>;
-export type ResumingOldSuccessionState = SuccessionContext & Readonly<{
-    phase: "resuming_old";
-    failedPhase: CodexSuccessionFailurePhase | "abort" | "barrier_busy";
-    safeErrorCode: string;
-}>;
-export type CodexRegistrationSuccessionState = ActiveOldSuccessionState | ActiveNewSuccessionState | FreezingSuccessionState | PreparedNewSuccessionState | PublishedNewSuccessionState | OfflinePoisonedSuccessionState | RecoveryRequiredSuccessionState | ResumingOldSuccessionState;
-type CorrelatedEvent = Readonly<{
-    generation: string;
-}>;
-export type CodexRegistrationSuccessionEvent = Readonly<{
-    type: "begin";
-    registration: CodexRegistrationIdentity;
-}> | (CorrelatedEvent & Readonly<{
-    type: "barrier_clean";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "barrier_busy";
-    safeErrorCode: string;
-}>) | (CorrelatedEvent & Readonly<{
-    type: "listener_prepared";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "store_prepared";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "publication_armed";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "publication_absence_confirmed";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "registry_published";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "activate";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "cleanup_confirmed";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "resume_confirmed";
-}>) | (CorrelatedEvent & Readonly<{
-    type: "abort";
-    safeErrorCode: string;
-}>) | (CorrelatedEvent & Readonly<{
-    type: "phase_failed";
-    phase: CodexSuccessionFailurePhase;
-    safeErrorCode: string;
-}>) | (CorrelatedEvent & Readonly<{
-    type: "restart_evidence";
-    publication: "absent" | "armed" | "published" | "unknown";
-    safeErrorCode: string;
-}>);
-export type CodexRegistrationSuccessionEffect = Readonly<{
-    type: "freeze_old_ingress";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "freeze_old_dispatch";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "quiesce_and_join_old";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "verify_full_barrier";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "create_fresh_listener_generation";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "purge_old_conversations";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "purge_old_reply_capabilities";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "prepare_new_store";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    /**
-     * Persist the irreversible publication intent. The controller must
-     * durably save the returned `publication_arming` machine state before
-     * executing this effect.
-     */
-    type: "arm_publication_journal";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "publish_new_registry";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "activate_new_registration";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "retire_old_generation";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "close_old_listener";
-    registration: CodexRegistrationIdentity;
-    /**
-     * Registry cleanup is a generation-owned compare-and-delete. It may
-     * unlink only the retired record and must preserve the active record.
-     */
-    registryUnlink: Readonly<{
-        onlyIfOwnedGeneration: string;
-        protectedActiveGeneration: string;
-    }>;
-}> | Readonly<{
-    type: "cleanup_unpublished_generation";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "resume_old_ingress";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "resume_old_dispatch";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "poison_new_generation";
-    registration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "take_registrations_offline";
-    oldRegistration: CodexRegistrationIdentity;
-    newRegistration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "cleanup_poisoned_generations";
-    oldRegistration: CodexRegistrationIdentity;
-    newRegistration: CodexRegistrationIdentity;
-}> | Readonly<{
-    type: "manual_recovery_required";
-    registration: CodexRegistrationIdentity;
-    safeErrorCode: string;
-}>;
-export type CodexRegistrationSuccessionTransition = Readonly<{
-    state: CodexRegistrationSuccessionState;
-    effects: readonly CodexRegistrationSuccessionEffect[];
-}>;
-export declare function createCodexRegistrationSuccession(active: CodexRegistrationIdentity): ActiveOldSuccessionState;
-export declare function transitionCodexRegistrationSuccession(state: CodexRegistrationSuccessionState, event: CodexRegistrationSuccessionEvent): CodexRegistrationSuccessionTransition;
-/**
- * Runtime assertion for controller boundaries and exhaustive state-machine
- * tests. It intentionally validates identities without interpreting their
- * opaque generation strings.
- */
-export declare function assertCodexRegistrationSuccessionInvariant(state: CodexRegistrationSuccessionState): void;
-export {};